Database
WordPress Vulnerability Database (page 1150)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
PB SEO Friendly Images
≤4.0.5No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via $logo
WSB Brands
≤1.1.8Update to 1.2
- Medium4.3Cross-Site Request Forgery to Settings Update
Store Locator for WordPress with Google Maps – LotsOfLocales
≤3.98.7Update to 3.98.8
- Medium5.3Information Exposure via wp_email_capture_options_process
Email Marketing Plugin – WP Email Capture
≤3.10Update to 3.11
- Medium4.3Cross-Site Request Forgery leading to Plugin Settings Updates
WordPress WP-Advanced-Search
≤3.3.8Update to 3.3.9
- High8.2Missing Authorization to Email Capture List Download
Email Marketing Plugin – WP Email Capture
≤3.10Update to 3.11
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Modern Footnotes
≤1.4.15Update to 1.4.16
- Medium4.3Cross-Site Request Forgery via wp_ajax_wpcrm_log_verbosity
Dynamics 365 Integration
≤1.3.12Update to 1.3.13
- Medium4.3Cross-Site Request Forgery via vsz_cf7_invisible_recaptcha_page
CF7 Invisible reCAPTCHA
≤1.3.3Update to 1.3.4
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via SVG files
Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files
≤2.7.1Update to 2.7.2
- Medium5.3Missing Authorization via reload.php
WordPress Console
≤0.3.9No patch available
- Medium5.3Sensitive Data Exposure via debug log file
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
≤1.17.1Update to 1.18.0
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Modern Events Calendar Lite
<6.10.5Update to 6.10.5
- Medium4.3Cross-Site Request Forgery
Chronoforms
≤7.0.9No patch available
- Medium4.3Cross-Site Request Forgery
LOGIN AND REGISTRATION ATTEMPTS LIMIT
≤2.1No patch available
- Medium4.3Cross-Site Request Forgery via image_sitemap_generate
Google XML Sitemap for Images
≤2.1.3No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Auto Rename Media On Upload
≤1.0.5Update to 1.1.0
- Medium4.3Cross-Site Request Forgery
xili-tidy-tags
≤1.12.03Update to 1.12.04
- High7.2Stored Cross-Site Scripting
Admin side data storage for Contact Form 7
≤1.1.2No patch available
- Medium4.3Cross-Site Request Forgery via wpbe_save_settings
WP Basic Elements
≤5.2.15Update to 5.3.0
- Medium6.1Reflected Cross-Site Scripting
Tags Cloud Manager
≤1.0.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Easy Event calendar
≤1.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Yandex.News Feed by Teplitsa
≤1.12.5No patch available
- Medium4.3Cross-Site Request Forgery to Settings Update
Customify
≤2.10.4Update to 2.10.5
- Medium5.4Cross-Site Request Forgery to Plugin De-Installation
Redirection
≤1.1.4Update to 1.1.5
- Medium5.3Missing Authorization
Coming Soon Landing Page and Maintenance Mode WordPress Plugin
≤2.2.0No patch available
- Medium5.4Reflected Cross-Site Scripting
Regina Lite
≤2.0.7No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
Robo Gallery – Photo & Image Slider
≤3.2.12Update to 3.2.13
- Medium5.4Cross-Site Request Forgery via delete()
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
≤4.4.2Update to 4.4.3
- Medium4.3Cross-Site Request Forgery via wp_ajax_wpcrm_log
Dynamics 365 Integration
≤1.3.12Update to 1.3.13